Is Allow Copy + safe?

Medium risk

Allow Copy + is medium risk. A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.

pidevexv3.0.8Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Developer's Website Can Read Your Activation History via postMessage

A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You visit the developer's own website, allowcopyplus.pidevex.com, including the walkthrough page the extension opens automatically right after installation.

The extension did this

A content script the extension injects on that site relays a postMessage to the service worker, which reads your activation history from storage and posts it back to the page.

The reply includes every hostname where you've turned the extension on or off, your on/off counts and their dates, and a persistent per-install ID, all readable by JavaScript running on the developer's page.

02EvidenceFIELD TABLE
What the developer's page receives in the EXT_RESP_STAT reply:
FieldValueWhy it matters
Sites where extension was activated
github.com, docs.google.com, mail.example.com (illustrative — the real list reflects your own activation history)Every hostname you've turned Allow Copy + on for is sent as a list, letting the page infer which sites you use it on.
Activation/deactivation counts and dates
{"activateCount":4,"deactivateCount":1,"lastActivateDate":"2026-07-02T09:14:00.000Z"} (illustrative — the real object reflects your own activation history)How many times you've turned the extension on and off, plus the timestamps of your most recent activate and deactivate.
Persistent install ID
a1b2c3d4-5e6f-4a1b-9c2d-3e4f5a6b7c8d (illustrative — a real UUID generated at install)A UUID generated once at install and never rotated, letting the site recognize your browser as the same visitor across separate site visits.
03EvidenceCODE COMPARE
The code that does this

The postMessage bridge as shipped vs. annotated

What it actually does
Content script, annotated974.[hash].js
// Content script injected on https://allowcopyplus.pidevex.com/*
window.addEventListener('message', async (event) => {
  // Only accepts requests whose page origin is the developer's own site...
  if (event.origin === new URL(WEB_SITE_URL).origin &&
      event.data?.type === 'EXT_GET_STAT') {
    // ...then forwards whatever the page sent as the request body
    const request = { type: 'WS_GetStat', data: event.data };
    chrome.runtime.sendMessage(request).then((response) => {
      if (response?.isSuccess) {
        // Posts the extension's reply straight back to the page
        window.postMessage({
          type: 'EXT_RESP_STAT',
          stat: response.data.stat,
          extId: response.data.extId,
          created: new Date().toISOString(),
        }, new URL(WEB_SITE_URL).origin);
      }
    });
  }
});
Service worker message handler, annotated285.[hash].js
// Service worker message handler
case 'WS_GetStat': {
  let result = { isSuccess: false };
  // Gate: sender's page origin must be the developer's site, AND the
  // extId in the request must equal this install's own runtime ID.
  if (sender.origin === new URL(WEB_SITE_URL).origin &&
      message.data?.extId === getExtId()) {
    await chrome.storage.sync.get().then((store) => {
      result = {
        isSuccess: true,
        data: {
          extId: getExtId(),
          created: new Date().toISOString(),
          stat: {
            stat: store[ACTIVATION_STAT_KEY],   // activate/deactivate counts + dates
            inst: store[INSTANCE_KEY],          // persistent per-install UUID
            domains: store[DOMAINS_KEY],        // every hostname you've toggled the extension on
          },
        },
      };
    }).catch(() => { result = { isSuccess: false }; });
  }
  sendResponse(result);
  break;
}
04EvidenceARTIFACT
Reproduce it yourself

Reproduces the postMessage handshake so you can see, in your own browser, exactly what activation data the extension discloses to this page.

RequiresAllow Copy + installedChrome DevTools
allowcopyplus-stat-reveal.js · js
// allowcopyplus-stat-reveal.js
// Run this in the DevTools console while visiting https://allowcopyplus.pidevex.com
// with "Allow Copy +" installed. It reproduces the handshake the page's own
// script performs, and logs whatever the extension discloses back to the page.

// 1. Find the extension's runtime ID. The extension discloses this itself: it
//    opens https://allowcopyplus.pidevex.com/how-to-use?ext_id=<RUNTIME_ID> right
//    after install, so a script on this origin can read it from location.href on
//    that first visit. If you're not on that URL, grab RUNTIME_ID from
//    chrome://extensions (enable Developer mode, copy the ID) and paste it below.
const RUNTIME_ID = new URLSearchParams(location.search).get('ext_id') || '<paste runtime id here>';

// 2. Listen for the extension's reply before sending the request.
window.addEventListener('message', (event) => {
  if (event.origin !== location.origin) return;
  if (event.data?.type !== 'EXT_RESP_STAT') return;
  console.log('Extension disclosed:', event.data);
}, { once: true });

// 3. Send the handshake the extension's own content script listens for.
window.postMessage({ type: 'EXT_GET_STAT', extId: RUNTIME_ID }, location.origin);
How to run it
  1. 1
    Paste into the DevTools console on https://allowcopyplus.pidevex.com with Allow Copy + installed, then press Enter.
05EvidenceTHIRD PARTY LIST
Where this reply is readable:
  • allowcopyplus.pidevex.com

    The developer's own site (PiDevEx/Allow Copy +), opened after install with the runtime ID in the URL, letting it request your activation history via postMessage later.

Updated 17 September 2026ajhbdcgfhlhhmocddefknjjkejcfpbnj